Method for identifying and verifying control software of a rail vehicle

ABSTRACT

A method identifies and verifies control software of a rail vehicle. In the method, the control software is formed by functions, with each function fulfilling an associated task. As a networked collective, the functions form the structure of the control program. A function-dependent checksum is generated for each function. A structure-dependent checksum is generated for the structure. A total checksum is generated for the control software from the function-dependent checksums and the structure-dependent checksum. The total checksum identifies and verifies the control software for homologation in a country.

The invention relates to a method for identifying and verifying controlsoftware of a rail vehicle.

Rail vehicles that are designed for transnational use have controlsoftware the functional elements of which, partially structured intoblocks, are connected inseparably to one another.

Control software corresponds to rules that are typical for a country andis authorized and verified for a rail network of a country.

A checksum is formed by way of the control software. Thecountry-specific authorization is carried out and the verification ofthe control software for this country is ensured based on the checksum.

In the case of different rules that are typical for a country, thisresults in different versions of an item of control software underconsideration for respective countries.

Manufacturers of control software would like to use standardizedauthorized control software for a large number of countries.

Taking this as a basis, disadvantages in the authorization process inEurope are outlined by way of example below:

There is the risk of control software that has already been authorizedin a first group of countries in Europe having to be changed due to anobjection from another country.

In the case of planned, transnational use, the control software, whichhas now been changed, loses the authorizations that have already beengranted in the countries of the first group of countries and has to beauthorized in them again.

There is additionally the danger that country-specific distinctions arerequired for selected functions of the control software, meaning thatapproaches that contradict one another across Europe need to be solvedfor the control software.

In order to minimize or to rectify these disadvantages, it is known tokeep country-specific control software on the rail vehicle. Whencrossing a border, associated country-specific control software is thenselected and loaded into a controller of the rail vehicle.

However, this approach entails the following disadvantages:

-   -   it is necessary to provide a redundant memory system for        different control software or for different control programs and        parameters in the vehicle,    -   programs and parameters have to be reloaded at national borders,        with the reloading being time-intensive due to the size of the        program,    -   it is necessary to take precautions as to whether the reloading        should take place when the rail vehicle is stationary or when it        is operating when crossing the border,    -   issues regarding responsibility during reloading have to be        clarified (for example whether or not the reloading must/should        be performed by the rail vehicle driver),    -   in the event that an authority denies authorization, it is        necessary to keep potentially older authorized programs and        parameters in order to be able to load them,    -   during maintenance, it has to be ensured that in each case        correct control software sets are installed on the redundant        memory systems,    -   multiple controllers are typically installed in a rail vehicle,        meaning that the number of programs is multiplied, resulting in        increased parts costs,    -   last of all, an increased investment has to be made in        development, management and maintenance of the programs.

In summary, the practicality of this approach is highly limited.

The object of the present invention is therefore to specify controlsoftware for a rail vehicle so as to enable easier authorization and atthe same time to at least reduce or entirely avoid the abovementioneddisadvantages.

This object is achieved by the features of claim 1. Advantageousdevelopments are specified in the respective dependent claims.

In the method according to the invention for identifying and verifyingcontrol software of a rail vehicle, the control software is described byfunctions that are structurally interconnected with one another in theirentirety.

A function performs a task assigned thereto, while the entirety of theinterconnection of the functions is referred to as a structure of thecontrol software.

A function-dependent checksum is created for each function, whereinchanges to a function are indicated by a change to the respectivechecksum.

A structure-dependent checksum is created for the structure, wherein achange to the structure is indicated by a change to the structuralchecksum.

An overall checksum is formed from the function-dependent checksums ofthe functions that are used and from the structure-dependent checksum ofthe structure and forms a unique fingerprint of particular controlsoftware and is used for verification.

Authorization in a country is performed based on the overall checksum.

A country-specific change is made to chosen functions and/or to thestructure. As a result, the function-dependent checksums and/or thestructure-dependent checksum and, ultimately, the overall checksum arechanged.

The country-specific change thus causes a change to the overallchecksum, which thus indicates this change.

Any required follow-up authorization is performed based on the overallchecksum.

An unchanged overall checksum indicates unchanged control software thatdoes not have to be checked and authorized again in a country-specificmanner.

A changed overall checksum accordingly indicates changed controlsoftware that has to be checked and authorized again in acountry-specific manner.

In the context of a detailed report able to be carried out on thecontrol software, unchanged function checksums indicate unchangedfunctions, the influence of which on the control software potentiallydoes not have to be checked again.

Accordingly, changed function checksums indicate changed functions, theinfluence of which on the control software has to be checked again.

In one advantageous development, in the case of unchanged functions andin the case of an unchanged structure of the control software, anoverall checksum is thus formed and indicates unchanged controlsoftware.

In the case of a change to the control software for country-specificreasons, a country-specific function is formed from a chosen unchangedfunction by changing the function. Forming the country-specific functionforms a country-specific overall checksum that differs from the overallchecksum of the unchanged control software.

In the case of a change to the structure of the control software forcountry-specific reasons, a country-specific structure is formed.Forming the country-specific structure forms a country-specific overallchecksum that differs from the overall checksum of the unchanged controlsoftware.

In one advantageous development, either the country-specific function orthe unchanged function is activated and operated in the control softwarewith the aid of a country identifier.

In the case of an activated country-specific function and in the case ofan unchanged structure of the control software, the country-specificoverall checksum of the control software is displayed for verification.

In the case of an activated unchanged function and in the case of anunchanged structure of the control software, the overall checksum of theunchanged control software is displayed for verification.

In one advantageous development, the country identifier is selected onthe basis of the rail network in which the rail vehicle is located orinto which the rail vehicle is traveling or entering.

In one advantageous development, the country identifier and/or acorresponding version number of the control software, which is based onthe overall checksum of the control software, is displayed to the railvehicle driver for monitoring purposes.

In one advantageous development, a first function supplies both theunchanged function and the country-specific function, as downstreamfunctions, with results. The two downstream functions ascertainrespective results. Using the country identifier, which acts on aselection block, only one of the results is however transmitted to afurther function.

In one advantageous development, when ascertaining the structure,branching points are detected in the signal profile of the controlsoftware. Connections identified by way of branching points aresubstituted in order to calculate the checksum of the structure.

The present invention makes it possible to uniquely identify theauthorization state of control software of a rail vehicle, and thus toverify an authorization.

In summary, an overall checksum is created for each item of railnetwork-dependent or country-dependent control software by way ofassociated source codes and provided with a version number. This forms ameaningful fingerprint for the control software for each country.

Depending on the national rail network in which the rail vehicle isoperated, the associated control software is activated and acorresponding version number of the control software is displayed to therail vehicle driver for monitoring purposes.

If changes are then made to the control software for a rail network of acountry, for example due to requirements of an authorization authority,then that part of the control software specific to this rail network issupplemented or modified.

Overlapping code or source code affected by changes is copied andmodified.

By virtue of a suitable method for creating the fingerprint, it ispossible, on the basis of the respective checksums, to show, for allunchanged network-specific parts of the control software, that thesehave not changed, meaning that another authorization for these softwareportions with authorities that have already authorized these softwareportions is no longer necessary.

The present invention makes it possible

-   -   to reduce authorization costs and risks,    -   to reduce what is known as “time to market”, and    -   to be able to implement network-specific client wishes with low        expenditure from an authorization viewpoint.

The present invention has in particular an advantage when the structureof the functions is able to be retained in the case of acountry-specific change to the control software.

It is then possible to easily change over between country-specificfunctions depending on rail networks or countries. The control softwareitself contains the respective functions. When crossing a border,uploading of country-specific control software is thus avoided; only acountry-induced functional changeover takes place when crossing theborder.

Changing over from a selected function to a country-specific functionachieves authorization in a destination country, and this is indicatedby the associated overall checksum.

At the same time, authorization that has already been granted in othercountries is maintained, since the selected function remains unchangedfor these countries, meaning that neither the checksums of the functionsinvolved nor the checksum of the structure nor the overall checksum arechanged.

The invention is explained in more detail below with reference to adrawing, in which:

FIG. 1 shows a basic illustration of a starting situation for the methodaccording to the invention,

FIG. 2 shows, with reference to FIG. 1 , a situation for subsequentconsiderations regarding the invention,

FIG. 3 shows, with reference to the previous figures, details regardingthe method according to the invention,

FIG. 4 shows, with reference to FIG. 3 , a first advantageous refinementof the method according to the invention,

FIG. 5 shows, with reference to FIG. 3 , a second advantageousdevelopment of the method according to the invention, and

FIG. 6 shows, with reference to FIG. 3 , a third advantageousdevelopment of the method according to the invention.

FIG. 1 shows a basic illustration of a starting situation for the methodaccording to the invention for an intended authorization of controlsoftware of a rail vehicle.

The method according to the invention is based on the fact that thecontrol software is formed as a program by a number of structurallyinterconnected functions FKT_1, FKT_2, FKT_3.

Each function FKT_1, FKT_2, FKT_3 is assigned a task to be performed.

A respective checksum is formed by way each function FKT_1, FKT_2, FKT_3in the form of what is known as a “hash”, such that

-   -   a first function FKT_1 has a first checksum HFKT_1,    -   a second function FKT_2 has a second checksum HFKT_2, and    -   a third function FKT_3 has a third checksum HFKT_3.

The functions FKT_1, FKT_2, FKT_3 of the control software, illustratedhere in highly simplified form, are structurally interconnected with oneanother.

The interconnection of the functions FKT_1, FKT_2, FKT_3 forms astructure STR. A checksum HSTR, referred to as a hash, is likewiseformed by way of this structure STR.

In the case of the structure STR shown here, the first function FKT_1 islinked to the third function FKT_3 either directly or via the secondfunction FKT_2.

An overall checksum HGES is formed from the checksums of the functionsHFKT_1 to HFKT_3 and from the checksum of the structure HSTR anduniquely describes the control software, and may thus be considered tobe its fingerprint.

The control software is authorized based on the overall checksum HGES.

FIG. 2 shows, with reference to FIG. 1 , a situation for subsequentconsiderations regarding the invention.

It is assumed here that authorization is not given for the secondfunction FKT_2 in a selected country, which is referred to hereinafteras destination country ZLL.

By way of example, in the context of the destination countryauthorization, a functionality of the second function FKT_2 that isadapted to the destination country ZLL is required. This situation isillustrated by a lightning symbol on the second function FKT_2.

FIG. 3 shows, with reference to the previous figures, details regardingthe method according to the invention.

It is assumed that a first authorization for Europe has been performedfor the control software.

This authorization, which is referred to hereinafter as EUauthorization, is based on an overall checksum HGES_EU.

The control software is however not authorized in the destinationcountry ZLL, which requires, with reference to FIG. 2 , a change to thesecond function FKT_2 illustrated in said figure.

The overall checksum HGES_EU is thus based on:

-   -   the first checksum HFKT_1 of the first function FKT_1,    -   a second checksum HFKT_2 EU of a second function FKT_2 EU,    -   the third checksum HFKT_3 of the third function FKT_3, and on    -   the checksum HSTR of the structure STR.

With regard to the previous figures, the second function FKT_2 EU shownhere corresponds to the second function FKT_2 described in FIG. 1 andFIG. 2 .

The second checksum HFKT_2 EU thus corresponds to the second checksumHFKT_2 described in FIG. 1 and FIG. 2 .

With regard to the previous figures, the overall checksum HGES_EU forthe EU authorization thus corresponds to the overall checksum HGESdescribed in FIG. 1 and FIG. 2 .

The authorization for the destination country ZLL, which is referred tohereinafter as ZLL authorization, is based on an overall checksumHGES_ZLL.

The overall checksum HGES_ZLL is based on:

-   -   the first checksum HFKT_1 of the first function FKT_1,    -   a second checksum HFKT_2 ZLL of a second function FKT_2 ZLL,    -   the third checksum HFKT_3 of the third function FKT_3, and based        on    -   the checksum HSTR of the structure STR.

For the destination country ZLL, the structure STR of the functionsFKT_1, FKT_2 ZLL, FKT_3 involved is unchanged with regard to theprevious figures.

Only the second function FKT_2 ZLL is adapted to country-specific rulesof the destination country ZLL or to rules of the associated railnetwork.

The second function FKT_2 ZLL accordingly has a checksum HFKT_2 ZLL thatis assigned thereto.

As described above, “hashes” or checksums are formed for the individualfunctions:

-   -   the first checksum HFKT_1 for the first function FKT_1,    -   the second checksum HFKT_2 ZLL for the second function FKT_2 ZLL        adapted to the destination country ZLL,    -   the third checksum HFKT_3 for the third function FKT_3.

It should be noted that the structure STR for the destination countryauthorization and for EU authorization is the same:

For the EU authorization, the first function FKT_1 is linked to thethird function FKT_3 either directly or via the second function FKT_2EU.

For the destination country authorization, the first function FKT_1 islinked to the third function FKT_3 either directly or via the secondfunction FKT_2 ZLL.

The checksum HSTR formed by way of the structure STR is thus identicalfor the countries in Europe and for the destination country.

In the context of the EU authorization, which applies for example forall countries in Europe but not for the destination country ZLL, thethird function FKT_3 thus uses results from the second function FKT_2EU, while, in the context of the destination country authorization, thethird function FKT_3 uses results from the second function FKT_2 ZLL.

For the EU authorization, the checksums HFKT_1, HFKT_2 EU, HFKT_3 andHSTR are used. The overall checksum HGES_EU is formed from thesechecksums.

For the destination country authorization, the checksums HFKT_1, HFKT_2ZLL, HFKT_3 and HSTR are used. An overall checksum HGES_ZLL is formedfrom these checksums.

One essential advantage of the present invention has an impressiveeffect here:

With the structure STR staying the same, when developing the controlsoftware, it is possible to change over between country-specificfunctions depending on rail networks or countries—here between thefunctions FKT_2 ZLL and FKT_2 EU depending on the country.

The control software itself contains both functions FKT_2 ZLL and FKT_2EU. When crossing a border, uploading of country-specific controlsoftware is thus avoided; only a functional changeover takes place whencrossing the border.

The country-specific second function FKT_2 ZLL means that thedestination country authorization is achieved and indicated by way ofthe overall checksum HGES_ZLL.

At the same time, the EU authorization is maintained, since its secondfunction FKT_2 EU=FKT_2 remains unchanged, meaning that the overallchecksum HGES_EU=HGES does not change either.

FIG. 4 shows, with reference to FIG. 3 , a first advantageous refinementof the method according to the invention.

With regard to the respective input of the second function FKT_2 EU orFKT_2 ZLL and the output of the first function FKT_1, a splitter blockSPLITTER1 is interposed, as shown.

A country-specific selection is made using the splitter block SPLITTER1,this being controlled with selection of the network identifier Netz_IDthat is supplied.

This constellation is used when either the function FKT_2 EU or thefunction FKT_2 ZLL, based on supplied results from the first functionFKT_1, calculates a respective result that is then passed on to thethird function FKT_3 for further processing.

The splitter block SPLITTER1 accordingly delivers results from the firstfunction FKT_1 either to the function FKT_2 EU or to the function FKT_2ZLL.

For the splitter block SPLITTER1, the country identifier is Netz_ID=ZLLwhen the rail vehicle is located in the destination country.Accordingly, for the splitter block SPLITTER1, the country identifier isNetz_ID=EU when the rail vehicle is located in the countries in Europe.

If the rail vehicle is located in the destination country ZLL, thecalculated results from the first function FKT_1 are transmitted orswitched through to the function FKT_2 ZLL by the splitter blockSPLITTER1 using the network identifier Netz_ID=ZLL.

If the rail vehicle is located in countries in Europe, the calculatedresults from the first function FKT_1 are transmitted or switchedthrough to the function FKT_2 EU by the splitter block SPLITTER1 usingthe network identifier Netz_ID=EU.

Based on this, a respective result is calculated by the function FKT_2EU or FKT_2 ZLL and is then passed on to the third function FKT_3 forfurther processing.

The splitter block SPLITTER1 has no influence on the structure STR; ithas a neutral function and is used only for the country-specificselection of the functions FKT_2 EU or FKT_2 ZLL. It accordingly has noinfluence on the checksum HSTR, which is identical both for thecountries in Europe and for the destination country.

In order to ascertain the structure STR, points of intersection begin tobe sought in the selection block SPLITTER1. Connections identified byway of the points of intersection are substituted and a checksum of thestructure HSTR is calculated.

This is achieved for example by ascertaining subnetworks that arelocated downstream of the selection block SPLITTER1:

-   -   Subnetwork 1: FKT_2 EU->FKT_3    -   Subnetwork 2: FKT_2 ZLL->FKT_3

These two subnetworks are intersected. It is thereby identified that apoint of intersection has to be present at the input of the thirdfunction FKT_3, which is referred to here as point of intersection SP1.

FIG. 5 shows, with reference to FIG. 3 , a second advantageousdevelopment of the method according to the invention.

With regard to the respective input of the second function FKT_2 EU orFKT_2 ZLL and the output of the first function FKT_1, a splitter blockSPLITTER2 is interposed, as shown.

With regard to the respective outputs of the second function FKT_2 EU orFKT_2 ZLL and the input of the third function FKT_3, a selection blockMERGER2 is interposed.

A country-specific selection is made using the selection block MERGER 2,this being controlled with selection of the network identifier Netz_IDthat is supplied.

This constellation is used when both functions FKT_2 EU and FKT_2 ZLLcalculate respective results based on the supplied results from thefirst function FKT_1, but only one of these is intended to be passed onto the third function FKT_3 for further processing.

The splitter block SPLITTER 2 accordingly delivers results from thefirst function FKT_1 both to the function FKT_2 EU and to the functionFKT_2 ZLL.

Both functions FKT_2 EU and FKT_2 ZLL, based thereon, calculaterespective results that are each passed on to the selection blockMERGER2.

A country-specific selection is then made using the selection blockMERGER2, this being controlled with selection of the network identifierNetz_ID.

For the selection block MERGER2, the country identifier is Netz_ID=ZLLwhen the rail vehicle is located in the destination country.Accordingly, the country identifier for the selection block MERGER2 isNetz_ID=EU when the rail vehicle is located in the countries in Europe.

If the rail vehicle is located in the destination country ZLL, thecalculated results from the second function FKT_2 ZLL are transmitted orswitched through to the third function FKT_3 by the selection blockMERGER2 using the network identifier Netz_ID=ZLL.

If the rail vehicle is located in countries in Europe, the calculatedresults from the second function FKT_2 EU are transmitted or switchedthrough to the third function FKT_3 by the selection block MERGER2 usingthe network identifier Netz_ID=EU.

The structure STR is ascertained in the same way as already describedabove: depending on the signal flow through ascertained subnetworks, amultiplicity of points of intersection or branching points areascertained and taken into consideration. Identified connections aresubstituted and ultimately a checksum of the structure HSTR iscalculated.

The splitter block SPLITTER2 has no influence on the structure STR; ithas a neutral function. It accordingly has no influence on the checksumHSTR, which is identical both for the countries in Europe and for thedestination country.

The selection block MERGER2 has no influence on the structure STR; ithas a neutral function and is used only for the country-specificselection of the results from the functions FKT_2 EU and FKT_2 ZLL. Itaccordingly has no influence on the checksum HSTR, which is identicalboth for the countries in Europe and for the destination country.

FIG. 6 shows, with reference to FIG. 3 , a third advantageousdevelopment of the method according to the invention.

With regard to the respective input of the second function FKT_2 EU orFKT_2 ZLL and the output of the first function FKT_1, a splitter blockSPLITTER3 is interposed as shown.

With regard to the respective outputs of the second function FKT_2 EU orFKT_2 ZLL and the input of the third function FKT_3, a selection blockMERGERS is interposed.

A country-specific selection is made using the splitter block SPLITTER3,this being controlled with selection of the network identifier Netz_IDthat is supplied.

This constellation is used when either the function FKT_2 EU or thefunction FKT_2 ZLL calculates a respective result based on suppliedresults from the first function FKT_1, which is then passed on to thethird function FKT_3 for further processing.

The splitter block SPLITTER3 accordingly delivers results from the firstfunction FKT_1 either to the function FKT_2 EU or to the function FKT_2ZLL.

For the splitter block SPLITTER3, the country identifier is Netz_ID=ZLLwhen the rail vehicle is located in the destination country.Accordingly, the country identifier for the splitter block SPLITTER3 isNetz_ID=EU when the rail vehicle is located in the countries in Europe.

If the rail vehicle is located in the destination country ZLL, thecalculated results from the first function FKT_1 are transmitted orswitched through to the function FKT_2 ZLL by the splitter blockSPLITTER3 using the network identifier Netz_ID=ZLL.

If the rail vehicle is located in countries in Europe, the calculatedresults from the first function FKT_1 are transmitted or switchedthrough to the function FKT_2 EU by the splitter block SPLITTER3 usingthe network identifier Netz_ID=EU.

Based thereon, a respective result is calculated by the function FKT_2EU or by the function FKT2_ZLL, which is then passed on by the selectionblock MERGER3 to the third function FKT_3 for further processing.

The structure STR is ascertained in the same way as already describedabove: depending on the signal flow through ascertained subnetworks, amultiplicity of points of intersection or branching points areascertained and taken into consideration. Identified connections aresubstituted and ultimately a checksum of the structure HSTR iscalculated.

The splitter block SPLITTER3 has no influence on the structure STR; ithas a neutral function and is used only for the country-specificselection of the functions FKT_2 EU or FKT_2 ZLL. It accordingly has noinfluence on the checksum HSTR, which is identical both for thecountries in Europe and for the destination country.

The selection block MERGER3 has no influence on the structure STR; ithas a neutral function. It accordingly has no influence on the checksumHSTR, which is identical both for the countries in Europe and for thedestination country.

In the context of one functionality not illustrated in more detail inthe figures, it is possible, with regard to the figures FIG. 5 and FIG.6 , to appropriately interpose both a splitter block SPLITTER3 and aselection block MERGER2 in the functions. Both blocks are controlledusing the country identifier Netz_ID. This refinement would beparticularly safe during operation or additionally made safer in linewith a possible client wish.

In the case of complex control software, a multiplicity of points ofintersection or branching points should be taken into considerationdepending on the signal flow when ascertaining subnetworks, these eachhaving to be ascertained and taken into consideration.

In summary, in the invention, with regard to the control software, astructure for its interconnected functions is ascertained.

A structure-dependent checksum is ascertained or calculated for thestructure in the form of a “hash”.

The structure-dependent checksum clearly indicates an associatedproperty of the structure.

A function-dependent checksum is ascertained or calculated for eachfunction of the control software in the form of a “hash”. Thefunction-dependent checksum clearly indicates content or a property ofthe function.

An overall checksum is ascertained or calculated from thefunction-dependent checksums and from the structure-dependent checksumand constitutes a unique fingerprint for the control software.

The overall checksum thus clearly indicates content or a property of thecontrol software.

An unchanged overall checksum indicates unchanged control software thatdoes not have to be checked again and does not have to be authorizedagain.

A changed overall checksum indicates changed control software that hasto be checked and authorized again.

1-9. (canceled)
 10. A method for identifying and verifying controlsoftware of a rail vehicle, wherein the control software being formed byfunctions, wherein each function of the functions performs a taskrespectively assigned thereto, wherein the functions, in theirinterconnected entirety, form a structure of the control software, whichcomprises the steps of: creating a function-dependent checksum for eachof the functions resulting in a plurality of function-dependentchecksums; creating a structure-dependent checksum for the structure;and creating an overall checksum for the control software from thefunction-dependent checksums and from the structure-dependent checksum,wherein the overall checksum identifies and verifies the controlsoftware for authorization in a country.
 11. The method according toclaim 10, wherein: in a case of unchanged functions and in the case ofan unchanged structure of the control software, forming the overallchecksum which indicates unchanged control software; and in a case of achange to the control software for country-specific reasons, forming acountry-specific function from a chosen unchanged function by changingthe function and forming a country-specific overall checksum thatdiffers from the overall checksum of the unchanged control software. 12.The method according to claim 11, wherein: in a case of the unchangedfunctions and the unchanged structure of the control software, formingthe overall checksum which indicates the unchanged control software; andin a case of a change to the structure of the control software for thecountry-specific reasons, forming a country-specific structure, andforming the country-specific overall checksum that differs from theoverall checksum of the unchanged control software.
 13. The methodaccording to claim 12, which further comprises: activating and operatingeither the country-specific function or the unchanged function in thecontrol software with an aid of a country identifier, in which, in acase of an activated country-specific function and in a case of theunchanged structure of the control software, the country-specificoverall checksum of the control software is displayed for verification,wherein in a case of an activated unchanged function and in a case ofthe unchanged structure of the control software, the overall checksum ofthe unchanged control software is displayed for verification.
 14. Themethod according to claim 13, which further comprises selecting thecountry identifier on a basis of a rail network in which the railvehicle is located or into which the rail vehicle is traveling.
 15. Themethod according to claim 13, which further comprises displaying thecountry identifier and/or a corresponding version number of the controlsoftware, which is based on the overall checksum of the controlsoftware, to a rail vehicle driver for monitoring purposes.
 16. Themethod according to claim 13, wherein: in the control software, a firstfunction supplies both the unchanged function and the country-specificfunction, as downstream functions, with results; two of the downstreamfunctions ascertain respective results; and the country identifierfunctions as a selection block, and only one of the results istransmitted to a further function.
 17. The method according to claim 13,wherein: in the control software, using the country identifier, whichacts on a selection block, a first function supplies either theunchanged function or the country-specific function, as downstreamfunctions, with results; one of the two downstream functions ascertainsa respective result; and an ascertained respective result is transmittedto a further function.
 18. The method according to claim 10, wherein:when ascertaining the structure, points of intersection are detected inthe signal profile of the control software; and connections identifiedby way of the points of intersection are substituted in order then tocalculate the checksum of the structure.